sentinelrag 0.2.0__tar.gz

sentinelrag-0.2.0/.env.example

@@ -0,0 +1,46 @@
+# Copy to .env — never commit .env
+# Prefix SENTINELRAG_ maps to Settings. Other keys are for provider SDKs.
+
+# --- App (OSS contributors: keep mock defaults) ---
+SENTINELRAG_APP_NAME=SentinelRAG
+SENTINELRAG_ENV=dev
+SENTINELRAG_HOST=0.0.0.0
+SENTINELRAG_PORT=8000
+SENTINELRAG_VECTOR_STORE_BACKEND=memory
+
+# --- Qdrant (Compose overrides URL to http://qdrant:6333) ---
+SENTINELRAG_QDRANT_URL=http://localhost:6333
+SENTINELRAG_QDRANT_COLLECTION=sentinelrag
+
+# --- Models (CI / offline defaults) ---
+SENTINELRAG_EMBEDDING_MODEL=mock-embedder
+SENTINELRAG_RERANKER_MODEL=mock-reranker
+SENTINELRAG_LLM_PROVIDER=mock
+SENTINELRAG_LLM_MODEL=mock-llm
+
+# --- Budgets ---
+SENTINELRAG_COST_BUDGET_USD=0.01
+SENTINELRAG_LATENCY_BUDGET_MS=2000
+
+# --- Optional production overrides (uncomment and fill locally) ---
+# SENTINELRAG_EMBEDDING_MODEL=BAAI/bge-small-en-v1.5
+# SENTINELRAG_LLM_PROVIDER=gemini
+# SENTINELRAG_LLM_MODEL=gemini-2.0-flash
+# GEMINI_API_KEY=
+
+# --- Other providers (unused unless SENTINELRAG_LLM_PROVIDER matches) ---
+OPENAI_API_KEY=
+AZURE_OPENAI_API_KEY=
+AZURE_OPENAI_ENDPOINT=
+AZURE_OPENAI_API_VERSION=2024-10-21
+AZURE_OPENAI_DEPLOYMENT=
+ANTHROPIC_API_KEY=
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+AWS_REGION=us-east-1
+HF_TOKEN=
+
+# --- Azure VM deploy (local ops only; never commit real values) ---
+# AZURE_VM_HOST=
+# AZURE_VM_USER=
+# AZURE_VM_SSH_KEY=

sentinelrag-0.2.0/.github/CODEOWNERS

@@ -0,0 +1,6 @@
+# Default owners
+* @prakash888kp
+
+/src/sentinelrag/gate/ @prakash888kp
+/src/sentinelrag/redteam/ @prakash888kp
+/.github/ @prakash888kp

sentinelrag-0.2.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,46 @@
+name: Bug report
+description: Something broke in SentinelRAG (tests, API, benchmarks, CI)
+labels: ["bug"]
+body:
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened?
+      description: What did you expect vs what you saw?
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        uv sync --extra dev
+        uv run pytest -k ...
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - retrieval / ingest
+        - eval / judges
+        - red-team / defenses
+        - router / agentic
+        - API / compose
+        - CI / benchmarks
+        - other
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      placeholder: v0.1.0 or git sha
+  - type: checkboxes
+    id: secrets
+    attributes:
+      label: Safety check
+      options:
+        - label: I did not paste API keys, passwords, or private `.env` contents
+          required: true

sentinelrag-0.2.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security sensitive report
+    url: https://github.com/prakash888kp/SentinelRAG/blob/master/SECURITY.md
+    about: Read SECURITY.md — do not post exploit details in public issues

sentinelrag-0.2.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,25 @@
+name: Feature request
+description: Propose an enhancement aligned with eval-gated RAG
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem or opportunity
+      description: What pain does this solve for RAG builders?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed approach
+    validations:
+      required: true
+  - type: checkboxes
+    id: gates
+    attributes:
+      label: Eval / security impact
+      options:
+        - label: Needs new or updated benchmark JSON
+        - label: Needs eval-gate or redteam-gate threshold change
+        - label: No gate impact (docs-only)

sentinelrag-0.2.0/.github/actions/sentinelrag-gate/action.yml

@@ -0,0 +1,42 @@
+name: SentinelRAG supply-chain gate
+description: Run unified retrieval, quality, and poison gates with SARIF/JUnit outputs
+inputs:
+  policy:
+    description: Path to gate_policy.yaml
+    required: false
+    default: config/gate_policy.yaml
+  baseline:
+    description: Baseline evidence JSON
+    required: false
+    default: benchmarks/baseline_evidence.json
+  refresh:
+    description: Regenerate benchmarks before gate
+    required: false
+    default: "false"
+  working-directory:
+    description: Repository root
+    required: false
+    default: "."
+outputs:
+  passed:
+    description: Whether the gate passed
+    value: ${{ steps.gate.outputs.passed }}
+runs:
+  using: composite
+  steps:
+    - name: Install package
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      run: |
+        pip install uv
+        uv sync --extra dev
+    - name: Run gate
+      id: gate
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      run: |
+        set -e
+        ARGS="run --policy ${{ inputs.policy }} --baseline ${{ inputs.baseline }}"
+        if [ "${{ inputs.refresh }}" = "true" ]; then ARGS="$ARGS --refresh"; fi
+        uv run sentinelrag-gate $ARGS
+        echo "passed=true" >> "$GITHUB_OUTPUT"

sentinelrag-0.2.0/.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    labels:
+      - dependencies
+      - security
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: weekly
+    labels:
+      - dependencies
+      - ci

sentinelrag-0.2.0/.github/labeler.yml

@@ -0,0 +1,18 @@
+gate:
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/sentinelrag/gate/**
+          - config/gate_policy.yaml
+security:
+  - changed-files:
+      - any-glob-to-any-file:
+          - src/sentinelrag/redteam/**
+          - src/sentinelrag/ingest/hygiene.py
+ci:
+  - changed-files:
+      - any-glob-to-any-file:
+          - .github/workflows/**
+docs:
+  - changed-files:
+      - any-glob-to-any-file:
+          - "**/*.md"

sentinelrag-0.2.0/.github/pull_request_template.md

@@ -0,0 +1,16 @@
+## Summary
+
+- 
+
+## Test plan
+
+- [ ] `uv run pytest`
+- [ ] `uv run ruff check src tests`
+- [ ] `uv run mypy src/sentinelrag`
+- [ ] Regenerated `benchmarks/*.json` if behavior changed
+- [ ] `uv run python scripts/verify_repo_secrets.py`
+
+## Gates
+
+- [ ] No secrets / `.env` files in the diff
+- [ ] CI eval thresholds updated only with justification in PR description

sentinelrag-0.2.0/.github/release.yml

@@ -0,0 +1,15 @@
+changelog:
+  exclude:
+    labels:
+      - dependencies
+  categories:
+    - title: Breaking Changes
+      labels: [breaking]
+    - title: Features
+      labels: [enhancement, feature]
+    - title: Fixes
+      labels: [bug, fix]
+    - title: Security
+      labels: [security]
+    - title: Other
+      labels: ["*"]

sentinelrag-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,28 @@
+name: ci
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+        with:
+          enable-cache: true
+      - name: Install
+        run: uv sync --extra dev
+      - name: Ruff
+        run: uv run ruff check src tests
+      - name: Mypy
+        run: uv run mypy src/sentinelrag
+      - name: Pytest
+        run: uv run pytest
+        env:
+          SENTINELRAG_ENV: ci
+          SENTINELRAG_LLM_PROVIDER: mock
+      - name: Secret scan (tracked files)
+        run: uv run python scripts/verify_repo_secrets.py

sentinelrag-0.2.0/.github/workflows/codeql.yml

@@ -0,0 +1,23 @@
+name: codeql
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+  schedule:
+    - cron: "17 7 * * 1"
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: python
+      - uses: github/codeql-action/autobuild@v3
+      - uses: github/codeql-action/analyze@v3

sentinelrag-0.2.0/.github/workflows/eval-gate.yml

@@ -0,0 +1,18 @@
+name: eval-gate
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+  workflow_call:
+
+jobs:
+  phase1-retrieval:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+      - run: uv sync --extra dev
+      - run: uv run python benchmarks/run_phase1_retrieval.py
+      - run: uv run python benchmarks/run_phase2_eval.py
+      - run: uv run python scripts/check_eval_gate.py

sentinelrag-0.2.0/.github/workflows/eval.yml

@@ -0,0 +1,9 @@
+name: eval
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  eval-gate:
+    uses: ./.github/workflows/eval-gate.yml

sentinelrag-0.2.0/.github/workflows/labeler.yml

@@ -0,0 +1,15 @@
+name: labeler
+
+on:
+  pull_request_target:
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: actions/labeler@v5
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}

sentinelrag-0.2.0/.github/workflows/redteam-gate.yml

@@ -0,0 +1,17 @@
+name: redteam-gate
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+  workflow_call:
+
+jobs:
+  redteam:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+      - run: uv sync --extra dev
+      - run: uv run python benchmarks/run_redteam_sweep.py
+      - run: uv run python scripts/check_redteam_gate.py

sentinelrag-0.2.0/.github/workflows/redteam.yml

@@ -0,0 +1,9 @@
+name: redteam
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  redteam-gate:
+    uses: ./.github/workflows/redteam-gate.yml

sentinelrag-0.2.0/.github/workflows/supply-chain-gate.yml

@@ -0,0 +1,24 @@
+name: supply-chain-gate
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+  workflow_call:
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+      - run: uv sync --extra dev
+      - run: uv run sentinelrag-gate run --refresh
+      - name: Upload gate artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: sentinelrag-gate
+          path: .sentinelrag/gate/

sentinelrag-0.2.0/.gitignore

@@ -0,0 +1,42 @@
+# Secrets & local env
+.env
+.env.*
+!.env.example
+
+# SSH / keys (never commit)
+*.pem
+*.ppk
+id_rsa*
+id_ed25519*
+sentinelrag_azure*
+
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+dist/
+build/
+.venv/
+venv/
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+.coverage
+htmlcov/
+coverage.xml
+
+# OS / IDE
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/
+*.swp
+
+# Local gate outputs (regenerate with sentinelrag-gate run)
+.sentinelrag/
+
+# Benchmarks / local data (keep committed JSON results when intentional)
+*.log
+data/raw/
+.qdrant/

sentinelrag-0.2.0/CHANGELOG.md

@@ -0,0 +1,20 @@
+# Changelog
+
+## [0.2.0] — 2026-11-08
+
+### Added
+
+- Pre-ingest **hygiene scanner** (`sentinelrag-gate scan`) and corpus **provenance** manifests.
+- Retrieval **hit_rate@k** + **latency_ms_mean** in Phase 1 / public benchmarks and evidence.
+- Citation coverage helper; expanded supply-chain gate policy.
+- Dependabot, CodeQL, CODEOWNERS, labeler, release notes config.
+- Poison benchmark v1, SARIF/JUnit evidence gate, composite Action (from 0.1.x line).
+
+### Changed
+
+- Package version **0.2.0**; README focused on install + out-of-box gate usage.
+- Maintainer-complete surface — no open “good first issue” backlog documents.
+
+## [0.1.0] — 2026-11-08
+
+- Phases 0–6: adaptive RAG, eval gates, red-team, OSS launch pack.

sentinelrag-0.2.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,36 @@
+# Contributor Covenant Code of Conduct
+
+## Our pledge
+
+We pledge to make participation in SentinelRAG a harassment-free experience for
+everyone, regardless of age, body size, disability, ethnicity, gender identity and
+expression, level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community
+
+Examples of unacceptable behavior:
+
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information without explicit permission
+
+## Enforcement
+
+Report unacceptable behavior via
+[GitHub Issues](https://github.com/prakash888kp/SentinelRAG/issues) (for public
+matters) or contact the maintainer through your preferred private channel if GitHub
+does not suffice.
+
+Maintainers may remove, edit, or reject contributions that violate this Code of Conduct.
+
+## Attribution
+
+Adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1.

sentinelrag-0.2.0/CONTRIBUTING.md

@@ -0,0 +1,37 @@
+# Contributing
+
+SentinelRAG optimizes for **reproducible supply-chain gates**. Keep benchmarks and tests offline-friendly.
+
+## Setup
+
+```bash
+git clone https://github.com/prakash888kp/SentinelRAG.git
+cd SentinelRAG
+uv sync --extra dev
+cp .env.example .env
+uv run pytest
+```
+
+## Before a PR
+
+```bash
+uv run ruff check src tests scripts benchmarks
+uv run mypy src/sentinelrag
+uv run pytest
+uv run sentinelrag-gate run --refresh
+uv run python scripts/verify_repo_secrets.py
+```
+
+Regenerate and commit `benchmarks/*.json` when behavior changes.
+
+## Standards
+
+- Python 3.11+, ruff + mypy strict on `src/sentinelrag`
+- No secrets in git (`.env` ignored)
+- Prefer focused PRs with tests
+
+## Community
+
+- **Maintainer:** PRAKASH KUMAR K ([@prakash888kp](https://github.com/prakash888kp))
+- **Support:** [GitHub Issues](https://github.com/prakash888kp/SentinelRAG/issues)
+- `CODE_OF_CONDUCT.md` · `SECURITY.md`

sentinelrag-0.2.0/Dockerfile

@@ -0,0 +1,15 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+RUN pip install --no-cache-dir uv
+
+COPY pyproject.toml README.md ./
+COPY data ./data
+COPY src ./src
+
+RUN uv pip install --system .
+
+EXPOSE 8000
+
+CMD ["uvicorn", "sentinelrag.api.app:app", "--host", "0.0.0.0", "--port", "8000"]

sentinelrag-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SentinelRAG contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.